Authentication
A bearer key, scoped to what it may do.
Authorization: Bearer mk_live_1a2b3c4d…Keys are shown once, when issued, and stored only as their SHA-256 — the same way a signing token is, and for the same reason. A key that is lost is replaced, not recovered.
Scopes
A key's scopes are its capabilities. There is no "full access" scope, because the useful question about an integration is not whether it is trusted but what it needs.
| Scope | What it carries |
|---|---|
| signing:read | Read templates, documents, certificates and packets. |
| signing:write | Prepare, send and void documents. |
| signing:templates | Create, publish and revise templates. |
| signing:workflows | Start a workflow for a participant. |
| signing:subjects | Import reservations, set guest lists, build and start packets. |
| signing:webhooks | Manage endpoints. |
A booking integration wants
signing:subjects, not signing:write. The two
are different trust levels: one is "act on my behalf", the other is "decide who
my guests are".
Test and live
Keys are prefixed mk_test_ or mk_live_. The prefix
is the first thing in the key and the first thing in our logs, so a test key
used against live data is visible immediately rather than after the invoice.
Revoking
Revoking a key needs a reason, and the reason goes on the audit trail. A key revoked is a membership deactivated in the same statement — there is no window in which the key is "revoked but still working".
Ready to build? An API key takes a minute in the portal, and the free plan covers the first 25 agreements a month.
Get an API key